Search
Find a vulnerability
Search criteria
6 vulnerabilities found for ManageIQ by ManageIQ
CVE-2026-52903 (GCVE-0-2026-52903)
Vulnerability from nvd – Published: 2026-10-12 12:16 – Updated: 2026-10-12 12:16
VLAI
EPSS
VEX
Title
YAML safe_load production fallback to unsafe_load enables RCE via deserialization
Summary
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.
Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.
Severity
8.8 (High)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ManageIQ | ManageIQ |
Affected:
0
(custom)
|
|
| Red Hat | Red Hat CloudForms |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ManageIQ/manageiq",
"defaultStatus": "affected",
"packageName": "manageiq",
"product": "ManageIQ",
"vendor": "ManageIQ",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"packageName": "manageiq",
"product": "Red Hat CloudForms",
"vendor": "Red Hat",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Red Hat would like to thank Martin Brodeur (Fluentlogic) for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"value": "A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.\n\nRed Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T12:16:00.508Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-52903"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486730"
}
],
"title": "YAML safe_load production fallback to unsafe_load enables RCE via deserialization",
"workarounds": [
{
"lang": "en",
"value": "The following practices would help for avoiding exposure to this flaw:\n1) Remove or disable the rescue Psych::DisallowedClass fallback in lib/extensions/yaml_load_aliases.rb.\n2) Alternatively, restrict dialog import access to trusted administrators only."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-52903",
"datePublished": "2026-10-12T12:16:00.508Z",
"dateReserved": "2026-06-09T07:23:36.531Z",
"dateUpdated": "2026-10-12T12:16:00.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22598 (GCVE-0-2026-22598)
Vulnerability from nvd – Published: 2026-01-21 20:51 – Updated: 2026-01-21 21:35
VLAI
EPSS
VEX
Title
ManageIQ vulnerable to DoS Attack when creating TimeProfiles
Summary
ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and API requests to timeout leading to a Denial of Service. Version radjabov-2 contains a patch. One may also apply the patch manually.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-21 21:35 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ManageIQ/manageiq/security/adv… | x_refsource_CONFIRM |
| https://github.com/ManageIQ/manageiq/commit/79cef… | x_refsource_MISC |
| https://github.com/ManageIQ/manageiq/commit/86132… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-21T21:35:16.904885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-21T21:35:27.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "manageiq",
"vendor": "ManageIQ",
"versions": [
{
"status": "affected",
"version": "\u003c radjabov-2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and API requests to timeout leading to a Denial of Service. Version radjabov-2 contains a patch. One may also apply the patch manually."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-21T20:51:52.972Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-m832-x3g8-63j3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-m832-x3g8-63j3"
},
{
"name": "https://github.com/ManageIQ/manageiq/commit/79cef10c7d0278d8a37c3f547c426948180df4df.patch",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ManageIQ/manageiq/commit/79cef10c7d0278d8a37c3f547c426948180df4df.patch"
},
{
"name": "https://github.com/ManageIQ/manageiq/commit/86132851257d73ed9e31a88315e47a8a2b838113",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ManageIQ/manageiq/commit/86132851257d73ed9e31a88315e47a8a2b838113"
}
],
"source": {
"advisory": "GHSA-m832-x3g8-63j3",
"discovery": "UNKNOWN"
},
"title": "ManageIQ vulnerable to DoS Attack when creating TimeProfiles"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22598",
"datePublished": "2026-01-21T20:51:52.972Z",
"dateReserved": "2026-01-07T21:50:39.533Z",
"dateUpdated": "2026-01-21T21:35:27.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-32756 (GCVE-0-2021-32756)
Vulnerability from nvd – Published: 2021-07-21 18:45 – Updated: 2024-08-03 23:33
VLAI
EPSS
VEX
Title
Arbitrary eval through MiqExpression
Summary
ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack.
Severity
8.8 (High)
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/ManageIQ/manageiq/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:55.684Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "manageiq",
"vendor": "ManageIQ",
"versions": [
{
"status": "affected",
"version": "\u003c jansa-4"
},
{
"status": "affected",
"version": "\u003c kasparov-2"
},
{
"status": "affected",
"version": "\u003c lasker-1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-21T18:45:15.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq"
}
],
"source": {
"advisory": "GHSA-32x4-vj4r-57rq",
"discovery": "UNKNOWN"
},
"title": "Arbitrary eval through MiqExpression",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-32756",
"STATE": "PUBLIC",
"TITLE": "Arbitrary eval through MiqExpression"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "manageiq",
"version": {
"version_data": [
{
"version_value": "\u003c jansa-4"
},
{
"version_value": "\u003c kasparov-2"
},
{
"version_value": "\u003c lasker-1"
}
]
}
}
]
},
"vendor_name": "ManageIQ"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq",
"refsource": "CONFIRM",
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq"
}
]
},
"source": {
"advisory": "GHSA-32x4-vj4r-57rq",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-32756",
"datePublished": "2021-07-21T18:45:15.000Z",
"dateReserved": "2021-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:33:55.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-52903 (GCVE-0-2026-52903)
Vulnerability from cvelistv5 – Published: 2026-10-12 12:16 – Updated: 2026-10-12 12:16
VLAI
EPSS
VEX
Title
YAML safe_load production fallback to unsafe_load enables RCE via deserialization
Summary
A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.
Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.
Severity
8.8 (High)
CWE
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| ManageIQ | ManageIQ |
Affected:
0
(custom)
|
|
| Red Hat | Red Hat CloudForms |
Affected:
0
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/ManageIQ/manageiq",
"defaultStatus": "affected",
"packageName": "manageiq",
"product": "ManageIQ",
"vendor": "ManageIQ",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "affected",
"packageName": "manageiq",
"product": "Red Hat CloudForms",
"vendor": "Red Hat",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Red Hat would like to thank Martin Brodeur (Fluentlogic) for reporting this issue."
}
],
"descriptions": [
{
"lang": "en",
"value": "A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.\n\nRed Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502: Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T12:16:00.508Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-52903"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486730"
}
],
"title": "YAML safe_load production fallback to unsafe_load enables RCE via deserialization",
"workarounds": [
{
"lang": "en",
"value": "The following practices would help for avoiding exposure to this flaw:\n1) Remove or disable the rescue Psych::DisallowedClass fallback in lib/extensions/yaml_load_aliases.rb.\n2) Alternatively, restrict dialog import access to trusted administrators only."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-52903",
"datePublished": "2026-10-12T12:16:00.508Z",
"dateReserved": "2026-06-09T07:23:36.531Z",
"dateUpdated": "2026-10-12T12:16:00.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22598 (GCVE-0-2026-22598)
Vulnerability from cvelistv5 – Published: 2026-01-21 20:51 – Updated: 2026-01-21 21:35
VLAI
EPSS
VEX
Title
ManageIQ vulnerable to DoS Attack when creating TimeProfiles
Summary
ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and API requests to timeout leading to a Denial of Service. Version radjabov-2 contains a patch. One may also apply the patch manually.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-21 21:35 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/ManageIQ/manageiq/security/adv… | x_refsource_CONFIRM |
| https://github.com/ManageIQ/manageiq/commit/79cef… | x_refsource_MISC |
| https://github.com/ManageIQ/manageiq/commit/86132… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22598",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-21T21:35:16.904885Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-21T21:35:27.687Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "manageiq",
"vendor": "ManageIQ",
"versions": [
{
"status": "affected",
"version": "\u003c radjabov-2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and API requests to timeout leading to a Denial of Service. Version radjabov-2 contains a patch. One may also apply the patch manually."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20: Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-21T20:51:52.972Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-m832-x3g8-63j3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-m832-x3g8-63j3"
},
{
"name": "https://github.com/ManageIQ/manageiq/commit/79cef10c7d0278d8a37c3f547c426948180df4df.patch",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ManageIQ/manageiq/commit/79cef10c7d0278d8a37c3f547c426948180df4df.patch"
},
{
"name": "https://github.com/ManageIQ/manageiq/commit/86132851257d73ed9e31a88315e47a8a2b838113",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ManageIQ/manageiq/commit/86132851257d73ed9e31a88315e47a8a2b838113"
}
],
"source": {
"advisory": "GHSA-m832-x3g8-63j3",
"discovery": "UNKNOWN"
},
"title": "ManageIQ vulnerable to DoS Attack when creating TimeProfiles"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-22598",
"datePublished": "2026-01-21T20:51:52.972Z",
"dateReserved": "2026-01-07T21:50:39.533Z",
"dateUpdated": "2026-01-21T21:35:27.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-32756 (GCVE-0-2021-32756)
Vulnerability from cvelistv5 – Published: 2021-07-21 18:45 – Updated: 2024-08-03 23:33
VLAI
EPSS
VEX
Title
Arbitrary eval through MiqExpression
Summary
ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack.
Severity
8.8 (High)
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/ManageIQ/manageiq/security/adv… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:55.684Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "manageiq",
"vendor": "ManageIQ",
"versions": [
{
"status": "affected",
"version": "\u003c jansa-4"
},
{
"status": "affected",
"version": "\u003c kasparov-2"
},
{
"status": "affected",
"version": "\u003c lasker-1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-07-21T18:45:15.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq"
}
],
"source": {
"advisory": "GHSA-32x4-vj4r-57rq",
"discovery": "UNKNOWN"
},
"title": "Arbitrary eval through MiqExpression",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-32756",
"STATE": "PUBLIC",
"TITLE": "Arbitrary eval through MiqExpression"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "manageiq",
"version": {
"version_data": [
{
"version_value": "\u003c jansa-4"
},
{
"version_value": "\u003c kasparov-2"
},
{
"version_value": "\u003c lasker-1"
}
]
}
}
]
},
"vendor_name": "ManageIQ"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq",
"refsource": "CONFIRM",
"url": "https://github.com/ManageIQ/manageiq/security/advisories/GHSA-32x4-vj4r-57rq"
}
]
},
"source": {
"advisory": "GHSA-32x4-vj4r-57rq",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-32756",
"datePublished": "2021-07-21T18:45:15.000Z",
"dateReserved": "2021-05-12T00:00:00.000Z",
"dateUpdated": "2024-08-03T23:33:55.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}